Castle.io (YC W16) | First Sales Hire | San Francisco, CA | ONSITE, Full-time

We are looking for our first sales hire to join our founding team and help protect millions of users from account takeover hacks.

You will work directly with the me and close new business for Castle by running the complete sales cycle for all deals. You will help with marketing, product, training, and scale the sales team.

Job description: https://jobs.lever.co/castle/d083fb7a-92de-4180-8a1a-50e32ee...

Castle (YC W16) | Sr. Data Scientist | San Francisco, CA | ONSITE

I'm one of the co-founders at Castle (https://castle.io), a seed funded cybersecurity startup. Castle uses machine learning to protect millions of consumers from account hacks.

We are hiring our second data scientist. We’re looking for someone who would be owning the core piece of our business -- our risk engine -- and who thrives in a fast-paced environment. The ideal candidate would have experience in fraud detection and/or security, and building real-time machine learning algorithms at scale.

Our office is located in San Francisco (SOMA), close to Civic Center BART Station. If you're looking for a small, close-knit startup with an opportunity to have a huge positive impact, please email me at johan@castle.io.

If you would block the analytics script for a user that normally have it enabled, that looks fishy to our detection. We don't (only) compare the collected data with known fraud profiles, but also with how the current user normally accesses the service.

Hey! Johan, co-founder of Castle here. My and my co-founder used to work in a financial startup and couldn't find any easy-to-use solutions for account monitoring. We built Castle to be a drop-in solution against account compromise. You track events in your web and mobile apps, and we analyze device, location and usage patterns to make sure they are consistent for each user.

We have lots of plans for improving the product: more 3rd-party integrations, built-in 2FA/captcha, APIs to build your own "security page" with device and session history. Would love to hear the feedback from the HN community!

I'm curious what verticals your customers are in. Unless your company is liable for account takeover it seems like this is a tough sell.

The risk of FPs and the lack of clear benefit to the company paying you you seems like a hard place to make money.

Thanks, this is valid feedback. You're right, account takeover is not the best description unless you're a big financial institution. When working with startups they use us for the (risk-based) authentication, and we're working in that direction, offering 2FA flows, security emails among other things.

Kul, grattis!

Worth mentioning is that JWT is used in the OpenID Connect standard, which is built on top of OAuth 2) for the authentication part. We use it in https://userbin.com to smoothly transfer user sessions between different platforms. Previously we used to roll our own (de-)serialization, signing, session expiration and encryption schemes, but JWT solves a lot of pain and makes it more obvious for developers to understand how this part of our authentication flow works, and are able to use the JWT libraries available in most programming languages.

Aside from the specifications, are there any resources you would recommend for implementing OpenID Connect? The results of a quick Google search are relatively sparse.

"Selective JPEG Compression" was a new one for me.

For PNG, always run your images through ImageOptim (http://imageoptim.com) before committing your work.

And for large PNGs, ImageAlpha (http://pngmini.com) lets you reduce bit depth, keep transparency and maintain a decent image quality.

> For PNG, always run your images through ImageOptim

Why only PNG?

I'm not the OP, but I've had trouble with the JPEGOptim feature of ImageOptim. It created JPEG files that crashed the JPEG decoder on some older android phones.

The files worked fine elsewhere, so I think it was an decoder bug not an invalid file, but I had to avoid optimizing JPEG files to avoid the problem.

This was about two years ago, so I don't recall version numbers or phone models.

Anecdotally, I find the best image compression using ImageOptim for PNGs and JPEGmini for JPGs. However, ImageOptim can also compress JPGs.

Not aware of an interactive modelling tool. There are visualization tools like http://railroady.prestonlee.com which generates graphs showing your model layout. Don't expect too much on the cosmetic side though.

What are the pains you primarily want to solve?

Would be interesting with more recent data on Kaggle.com usage. Anyone?

Hi, I'm co-founder and dev at Userbin. We want the integration of Userbin to feel somewhat similar to what you're used to when working with your favorite Ruby, Node or PHP auth library, rather than being a provider of a cloud-based database of user records. To be in the cloud is not the essence of Userbin, more a vehicle for providing a common configuration interface and suite of management tools.

View Userbin as a kind of aggregator of all the boring and tedious things involved in setting up OAuth connections, designing login flows and tweaking transactional emails. For every new user that signs up through your Userbin account, you create your own local copy of its Userbin profile, much like you're used to when integrating an OAuth provider.